@4fu/dsh-arbor-env 0.0.0-stage → 2026.1110.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 4fuu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,250 @@
-# Temporary Holding Version
+# dsh-arbor
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Run [arbor](https://github.com/4fuu/arbor) as the agent driver inside
+[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).
+
+DSH gives a user a session, a transcript, approvals, plugins, skills and a model
+picker. arbor gives an agent disposable context windows over one shared journal,
+note store and workspace, instead of one long conversation. dsh-arbor connects
+them: one arbor host runs inside the DSH process, each DSH session that selects
+**Arbor** is served by that host, and the window's reply is written back to the
+DSH session as an ordinary assistant message. A DSH session that does not select
+Arbor keeps running on DSH's own embedded AgentLoop, in the same process.
+
+> **Status.** This is a research-grade integration, not a DSH release. It is
+> pinned to one DSH version and relies on DSH internals. Read
+> [Versions and compatibility](docs/versions.md) before installing it on
+> anything you care about. The packages are published under `@4fu` at
+> `2026.1110.1`; the bundle and the font plugin install independently from npm.
+
+## What an arbor session changes
+
+Choosing **Arbor** in a DSH composer creates the session under the `arbor` agent
+preset. That session then runs on arbor, and the following are true for it:
+
+- **One window per turn, one chain per session.** A DSH session is one arbor
+  conversation: its first turn opens a window, a window that ends hands off to a
+  continuation, and the next turn drives the chain. The journal and note store
+  live under `$DSH_HOME/arbor/` and survive a restart.
+- **arbor's workspace, not DSH's sandbox.** A window works in arbor's shared
+  folder (`$DSH_HOME/arbor/shared`). When the `ovnfs` binary is available a
+  window opens a copy-on-write checkout and merges back with `apply`; otherwise
+  arbor uses a plain directory. **There is no DSH sandbox for an arbor session:**
+  arbor's file tools and commands run on the host, and arbor's own secret scrub
+  is the only protection on what reaches the model.
+- **arbor's projects.** The shared folder's project folders are the DSH project
+  list for arbor composers. A directory the user adds outside the shared folder
+  is recorded as an external pointer for that session and used in place.
+- **arbor's prompt and tools.** DSH's official prompt sections are decided one by
+  one; the ones arbor replaces are absent, third-party sections go into a
+  `<dsh>` data block, and a trusted `<harness>` section says what remains true of
+  DSH. DSH tools are offered to the model as arbor external tools, and arbor's
+  own tools replace DSH tools with the same capability.
+- **The Arbor page.** A permanent **Arbor** entry in DSH's left navigation opens
+  the whole-host overview and one tab per arbor session: windows, chains,
+  handoffs, projects, the board, notes, `/env`, schedules and arbor's search.
+  An arbor composer hides DSH's sandbox access-mode switch, because that switch
+  does not apply to it.
+
+## What stays untouched in ordinary DSH sessions
+
+A session that does not select Arbor is an ordinary DSH session. It keeps:
+
+- DSH's embedded AgentLoop, session format, turn boundaries and streaming path;
+- DSH's sandbox policy and its `ctx.fs` / `ctx.shell` file and command tools;
+- DSH's project management, working directory and prompt assembly;
+- its composer, sandbox access-mode switch, header and sidebar behavior.
+
+It gets **no Arbor tab** and no arbor windows. The only shared surface is the
+permanent Arbor entry in the left navigation, which simply does not list that
+session. The routing registry replaces DSH's base `agent` row so it can send
+`agentPreset: 'arbor'` sessions to arbor; every other session goes to the
+official loop. Approvals still use DSH's approval path for both kinds of
+session, and arbor's windows are registered so DSH's sidebar leaves them out.
+
+## Screenshots
+
+| Overview, light | Overview, dark |
+| --- | --- |
+| ![Arbor overview in light mode](docs/screenshots/overview-light.png) | ![Arbor overview in dark mode](docs/screenshots/overview-dark.png) |
+| **Session tab, light** | **Session tab, dark** |
+| ![An arbor session tab in light mode](docs/screenshots/session-light.png) | ![An arbor session tab in dark mode](docs/screenshots/session-dark.png) |
+
+These are the web profile at 1440 px wide with the optional
+[font plugin](https://github.com/4fuu/dsh-arbor-fonts) installed: ChillDIN
+Gothic for labels and ChillDIN for numerals, while body text and code keep
+DSH's fonts. The same overview without the plugin is
+[here](docs/screenshots/overview-without-fonts.png).
+
+## Install
+
+Requirements: Node.js 24.9 or newer and DeepSeek Harness `dsh-v0.2.2-rc.1`.
+The bundle is published with all packages it depends on; nothing has to be
+built or linked.
+
+```bash
+npm install -g @deepseek-ai/dsh@0.2.2-rc.1
+dsh plugin --profile web add @4fu/dsh-arbor-bundle@2026.1110.1
+dsh web
+```
+
+`dsh plugin` adds the bundle to the profile's `dsh.profile.bundles` and installs
+its packages into the profile. The packages declare DSH's runtime packages as
+peer dependencies, so the profile keeps DSH's own copies rather than installing
+a second set. Pick **Arbor** in a composer and send a message.
+The optional [font plugin](https://github.com/4fuu/dsh-arbor-fonts) installs the
+same way, but it is a Host row rather than a bundle. Add the row to the
+profile's `cordis.patch.yml` after installing it:
+
+```bash
+dsh plugin --profile web add @4fu/dsh-arbor-fonts@2026.1110.0
+```
+
+```yaml
+- insert:
+    - id: arbor-fonts
+      name: '@4fu/dsh-arbor-fonts'
+```
+
+Replace the default `[]` in that file with the entry, then restart the profile.
+
+### From a checkout
+
+The proofs and development use the TypeScript sources directly; that checkout is
+what the scripts and the pin check run against.
+
+```bash
+git clone https://github.com/4fuu/dsh-arbor
+cd dsh-arbor
+pnpm install --frozen-lockfile
+pnpm check                 # tsc --noEmit over every package and proof
+pnpm proofs                # 29 proofs against the scripted model
+```
+
+The first install may ask pnpm to approve dependency build scripts. Do not
+approve them by hand: the repository's `pnpm-workspace.yaml` already denies the
+six scripts it pulls in, each with the reason, and `pnpm install` finishes
+cleanly with that policy.
+
+### Hand the install to a model
+
+[docs/install-for-agents.md](docs/install-for-agents.md) is a step-by-step guide
+written for an AI agent: install from npm or a checkout, run the proofs, drive a
+live turn with a restart, boot the web profile, and inspect what ran. Give a
+model this prompt, editing the bracketed parts or dropping them:
+
+```text copy Copy Install Prompt
+Install dsh-arbor (https://github.com/4fuu/dsh-arbor) in this environment [in a
+scratch DSH home under /tmp] and show me that it works: follow
+docs/install-for-agents.md, install @4fu/dsh-arbor-bundle@2026.1110.1 into a DSH
+web profile, pick Arbor for one session, and [also run the proof suite from a
+checkout with pnpm install --frozen-lockfile, pnpm check and pnpm proofs]. Report
+which checks passed, what the live session answered, and anything that did not
+work. Fix only what is yours to fix and tell me what you changed.
+```
+
+## Use it in DSH
+
+The npm install above adds the bundle to a DSH web profile. Pick **Arbor** in a
+composer and send a message: the session is created under the preset, its window
+and chain appear under the **Arbor** entry, and an ordinary session started
+beside it keeps DSH's own composer and sandbox behavior. A checkout can also be
+wired by hand; [section 7 of the install guide](docs/install-for-agents.md#7-wiring-the-bundle-into-a-real-dsh-installation)
+shows the profile layout.
+
+The one-shot `dsh <task>` runner cannot drive an arbor-preset session: DSH's
+runner refuses to adopt a session that runs under a preset. Use the web client,
+the SDK path the proofs use, or a remote `agent-preset/select` on a blank.
+
+## Pinned DSH version
+
+DSH is pinned to **`dsh-v0.2.2-rc.1`** (npm
+`@deepseek-ai/dsh@0.2.2-rc.1`, commit `66491b05e3` of
+`deepseek-ai/deepseek-harness`). Every `@deepseek-ai/dsh*` dependency is an
+exact version, every package under `packages/` declares
+`engines.dsh: 0.2.2-rc.1`, and `pnpm check:pin` checks both plus the prompt
+bridge's `DSH_PINNED_VERSION`. DSH's runtime packages are peer dependencies, and
+`pnpm check:profile` installs the packed packages into a fresh DSH web profile to
+prove the profile keeps one copy and can create both kinds of session.
+
+A different DSH version is unsupported. The bundle depends on DSH's row names,
+its one-`AgentFactory` rule, its prompt-section registry, its client slot
+registration and its exact Fetch registry; a move in any of them can fail the
+boot, leave an official prompt section undecided, or stop the Arbor page from
+registering. `proofs/12-official-sections.ts` and `proofs/18-picker-pin.ts`
+are the behavioral checks. The canonical pin and the upgrade procedure are in
+[Versions and compatibility](docs/versions.md).
+
+## Optional: the font plugin
+
+[dsh-arbor-fonts](https://github.com/4fuu/dsh-arbor-fonts) is a separate DSH
+client plugin that changes only the typography of the Arbor page. It sets
+ChillDIN Gothic for display labels and ChillDIN for numerals, leaves body text
+and code on DSH's fonts, and does nothing on ordinary pages. It is optional and
+installs into the same DSH profile:
+
+```bash
+dsh plugin --profile web add @4fu/dsh-arbor-fonts@2026.1110.0
+```
+
+The fonts are licensed under the SIL Open Font License 1.1; the plugin ships the
+license text, per-file hashes and attribution. The plugin is a Host row rather
+than a bundle: after installing it, add the `arbor-fonts` entry described under
+[Install](#install) to `cordis.patch.yml` and restart the profile.
+
+## Limits worth knowing
+
+- The judge is off: a model-based judge cannot run through the DSH backend yet.
+- The 12 bundle packages are published together at one version; install and
+  upgrade the bundle as a unit, because its packages name each other exactly.
+- `ovnfs` is optional. Without it arbor uses the plain-directory workspace, and a
+  window no longer gets a copy-on-write checkout.
+- The web page's numbers and layout are read from arbor's journal and API; it is
+  not a generic DSH dashboard, and it deliberately shows only arbor sessions.
+- The prompt bridge, the UI and the picker filter are pinned to DSH's internals,
+  not to a stable public API. See [Versions and compatibility](docs/versions.md).
+
+## Documentation
+
+- [Installing and inspecting dsh-arbor](docs/install-for-agents.md) — the
+  agent-facing install, proof, live-turn, web-profile and wiring guide.
+- [Versions and compatibility](docs/versions.md) — the DSH and arbor pins, and
+  what breaks on another DSH version.
+- [B0 findings](docs/b0-findings.md), [B3 findings](docs/b3-findings.md) and
+  [B3b projects and sandbox](docs/b3b-projects-and-sandbox.md) — historical
+  records of the integration's decisions, with the DSH source locations each
+  one rests on. They describe earlier stages; the install guide is the current
+  status.
+- [Layout and proofs](#layout) below for a quick map of the packages.
+
+## Layout
+
+```text
+packages/
+  arbor-host/       one Arbor host per process: SQLite journal and notes,
+                    settings, window lifecycle, workspace and environment
+  arbor-driver/     the routing AgentRegistry, AgentFactory, session agent,
+                    inbox and stream mirrors, and the journal relay
+  arbor-llm/        the arbor AgentBackend over DSH's ctx.llm and ctx.tools
+  arbor-prompt/     <harness>, the <dsh> data block, and the section table
+  arbor-tools/      DSH tools as arbor external tools, same-name replacement
+  arbor-workspace/  arbor's workspace over the shared folder (ovnfs or dir)
+  arbor-env/        /env, with DSH's skills and MCP servers mounted read-only
+  arbor-bundle/     the installable patch that mounts the rows and UI
+  arbor-facts/      the read face behind the Arbor page and its Fetch routes
+  arbor-ui/         the Arbor page, session tabs, copy and composer gate
+  arbor-ui-workspace/
+                    the per-preset hero project picker
+  arbor-preset/     the agent-preset row that puts Arbor in the roster
+  arbor-testkit/    the boot harness, memory journal and scripted model
+patches/            overlay layers a proof applies above the shipped profile
+proofs/             one runnable proof per integration point
+docs/               install, versions, screenshots and historical findings
+scripts/            the pin and profile checks, the release build and packing
+```
+
+## License
+
+MIT. See [LICENSE](LICENSE). The optional font plugin vendors fonts under the
+SIL Open Font License 1.1; its repository carries the license text and
+attribution.

package/index.d.ts

@@ -0,0 +1,121 @@
+/**
+ * `/env` inside DSH: arbor's own environment, with DSH's skills and MCP servers
+ * mounted read-only beside it (docs/environment.md).
+ *
+ * The environment's home is `<DSH_HOME>/arbor/env`, and it is arbor's own
+ * `DirectoryEnvironment`: the settings at `/env/settings.json`, arbor's built-in
+ * skills, and everything the model installs itself with `reload` all keep
+ * working exactly as they do in any other deployment.
+ *
+ * What this package adds is DSH's side of the world:
+ *
+ *  - **DSH's skills** are read from `ctx.skills`, DSH's own layered registry,
+ *    and mounted by writing each one's body to `<env>/skills/<name>/SKILL.md`.
+ *    The model sees them in `<env>` with that path and reads them with `read`;
+ *    they are read-only, because a change goes through DSH, not through arbor's
+ *    `reload`.
+ *  - **DSH's MCP servers** are listed from the tools DSH publishes under the
+ *    `mcp__<server>__<tool>` names. Their tools stay DSH tools — the tool bridge
+ *    brings them in as external tools — so the item declares no functions and no
+ *    arbor MCP module is created for it. Duplicating them as modules would give
+ *    the model two ways to call the same tool.
+ *
+ * The mount is live: `skills/change` re-reads DSH's catalog, so a skill a DSH
+ * plugin adds or removes reaches `/env` without a restart.
+ */
+import type { EnvDelta, EnvDraft, EnvItem, EnvItemName, EnvItemRef, EnvRef, EnvRevision, EnvValidation, Environment, Settings } from '@4fu/arbor-interfaces';
+import { DirectoryEnvironment } from '@4fu/arbor-environment-dir';
+import { type DshSkillSource } from './skills.js';
+/** What this package needs from the DSH process it runs in. */
+export interface DshEnvironmentOptions {
+    /** The environment arbor's own items live in, rooted under `DSH_HOME/arbor`. */
+    readonly inner: DirectoryEnvironment;
+    /** DSH's own skill registry, and how to hear that it moved. */
+    readonly skills: DshSkillSource;
+    /** Every tool name DSH publishes, for the MCP servers among them. */
+    readonly toolNames: () => readonly string[];
+    /** The working directory DSH's skills are read for. Defaults to the host's. */
+    readonly cwd?: () => string;
+    /**
+     * The settings the host runs with until the model installs its own at
+     * `/env/settings.json`.
+     *
+     * Arbor reads its identity, general rules, judge and model tiers from the
+     * environment once one is mounted, and answers `undefined` until a settings
+     * item is installed — which would leave a window with no identity at all. The
+     * deployment's own settings are the seed, so a fresh `DSH_HOME` behaves
+     * exactly as it did before `/env` existed, and the model's own install
+     * replaces them the moment it makes one.
+     */
+    readonly seedSettings?: Settings;
+}
+export declare class DshEnvironment implements Environment {
+    private readonly inner;
+    private readonly skills;
+    private readonly toolNames;
+    private readonly cwd;
+    private readonly seed;
+    /** The mounted DSH skills and MCP servers, read the last time `list` ran. */
+    private mounted;
+    /** The names DSH owns, which arbor's own `reload` may not touch. */
+    private owned;
+    /** Set while this package is writing the mount, so a re-read is not recursive. */
+    private syncing;
+    constructor(options: DshEnvironmentOptions);
+    /** The shared mount every window reads `/env` through. */
+    get mount(): string;
+    /** The directory the mount is, on the host, which the file tools read. */
+    get directory(): string;
+    /** Every item: arbor's own, then DSH's mounted ones. */
+    list(): Promise<readonly EnvItem[]>;
+    /** Re-read DSH's skills and MCP servers, and write the mount. */
+    refresh(): Promise<void>;
+    /** The items DSH owns, as arbor's environment lists them. */
+    private dshItems;
+    /** The revisions, arbor's own: a mounted item has none of its own to give. */
+    history(item?: EnvItemRef | EnvItemName): Promise<readonly EnvRevision[]>;
+    /**
+     * The settings: the model's own from `/env/settings.json` once it installs
+     * one, and the deployment's seed until then.
+     */
+    settings(): Promise<Settings | undefined>;
+    /**
+     * Validate drafts, refusing the whole call when one names an item DSH owns.
+     *
+     * Everything else is the inner environment's own validation, so a skill
+     * parses and an MCP server starts and lists its functions exactly as it does
+     * in any other deployment.
+     */
+    validate(drafts: readonly EnvDraft[]): Promise<EnvValidation>;
+    /** Install drafts, refusing one that names an item DSH owns. */
+    install(drafts: readonly EnvDraft[], remove?: readonly (EnvItemRef | EnvItemName)[]): Promise<EnvRevision>;
+    /** Remove items, refusing one that names an item DSH owns. */
+    remove(items: readonly (EnvItemRef | EnvItemName)[]): Promise<EnvRevision>;
+    /** What changed since a revision. DSH's mounted items never change one. */
+    delta(since: EnvRef): Promise<EnvDelta>;
+    /** The revision the environment stands at, arbor's own. */
+    revision(): Promise<EnvRef>;
+    /** Start every installed service again, after a host restart. */
+    resume(): Promise<void>;
+    /**
+     * Call one function of an installed MCP server.
+     *
+     * A mounted DSH server has no functions here — its tools are DSH tools and
+     * run through the tool bridge — so a call naming one is refused rather than
+     * silently sent somewhere else.
+     */
+    call(server: string, fn: string, args: Record<string, unknown>): Promise<string>;
+    /** One refusal naming an item DSH owns, in this package's own words. */
+    private readonly;
+    /** One fixed string, from this package's own table. */
+    private text;
+    /** The drafts whose names DSH owns, as `kind:name` entries. */
+    private takenBy;
+    /** The item names a removal list names, as `kind:name` entries. */
+    private namedBy;
+    /** Refuse a call that would change an item DSH owns. */
+    private refuseTaken;
+}
+export { dshEnvText } from './text.js';
+export { readDshSkills, syncSkills, skillDirectory, skillFile, dshSkillSource, type DshSkill, type DshSkillSource, } from './skills.js';
+export { serversOfToolNames, serverOfToolName, type DshServer } from './servers.js';

package/index.js

@@ -0,0 +1,248 @@
+/**
+ * `/env` inside DSH: arbor's own environment, with DSH's skills and MCP servers
+ * mounted read-only beside it (docs/environment.md).
+ *
+ * The environment's home is `<DSH_HOME>/arbor/env`, and it is arbor's own
+ * `DirectoryEnvironment`: the settings at `/env/settings.json`, arbor's built-in
+ * skills, and everything the model installs itself with `reload` all keep
+ * working exactly as they do in any other deployment.
+ *
+ * What this package adds is DSH's side of the world:
+ *
+ *  - **DSH's skills** are read from `ctx.skills`, DSH's own layered registry,
+ *    and mounted by writing each one's body to `<env>/skills/<name>/SKILL.md`.
+ *    The model sees them in `<env>` with that path and reads them with `read`;
+ *    they are read-only, because a change goes through DSH, not through arbor's
+ *    `reload`.
+ *  - **DSH's MCP servers** are listed from the tools DSH publishes under the
+ *    `mcp__<server>__<tool>` names. Their tools stay DSH tools — the tool bridge
+ *    brings them in as external tools — so the item declares no functions and no
+ *    arbor MCP module is created for it. Duplicating them as modules would give
+ *    the model two ways to call the same tool.
+ *
+ * The mount is live: `skills/change` re-reads DSH's catalog, so a skill a DSH
+ * plugin adds or removes reaches `/env` without a restart.
+ */
+import { arborError } from '@4fu/arbor-errors';
+import { textOf } from '@4fu/arbor-prompt';
+import { DirectoryEnvironment } from '@4fu/arbor-environment-dir';
+import { readDshSkills, syncSkills } from "./skills.js";
+import { serversOfToolNames } from "./servers.js";
+import { dshEnvText } from "./text.js";
+export class DshEnvironment {
+    inner;
+    skills;
+    toolNames;
+    cwd;
+    seed;
+    /** The mounted DSH skills and MCP servers, read the last time `list` ran. */
+    mounted = { skills: [], servers: [] };
+    /** The names DSH owns, which arbor's own `reload` may not touch. */
+    owned = new Set();
+    /** Set while this package is writing the mount, so a re-read is not recursive. */
+    syncing = false;
+    constructor(options) {
+        this.inner = options.inner;
+        this.skills = options.skills;
+        this.toolNames = options.toolNames;
+        this.cwd = options.cwd ?? (() => process.cwd());
+        this.seed = options.seedSettings;
+        // DSH's catalog moving re-reads it, so a skill a plugin adds or removes
+        // reaches `/env` without a restart.
+        this.skills.onChange(() => {
+            if (this.syncing)
+                return;
+            void this.refresh().catch(() => { });
+        });
+    }
+    /** The shared mount every window reads `/env` through. */
+    get mount() {
+        return this.inner.mount;
+    }
+    /** The directory the mount is, on the host, which the file tools read. */
+    get directory() {
+        return this.inner.directory;
+    }
+    /** Every item: arbor's own, then DSH's mounted ones. */
+    async list() {
+        await this.refresh();
+        return [...await this.inner.list(), ...this.dshItems()];
+    }
+    /** Re-read DSH's skills and MCP servers, and write the mount. */
+    async refresh() {
+        this.syncing = true;
+        try {
+            const cwd = this.cwd();
+            const skills = await readDshSkills(this.skills, cwd);
+            const servers = serversOfToolNames(this.toolNames());
+            await syncSkills(this.inner.directory, skills);
+            this.mounted = { skills, servers };
+            this.owned = new Set([
+                ...skills.map(skill => `skill:${skill.name}`),
+                ...servers.map(server => `mcp:${server.name}`),
+            ]);
+        }
+        finally {
+            this.syncing = false;
+        }
+    }
+    /** The items DSH owns, as arbor's environment lists them. */
+    dshItems() {
+        const items = [];
+        for (const skill of this.mounted.skills) {
+            items.push({
+                ref: `dsh:skill:${skill.name}`,
+                kind: 'skill',
+                name: skill.name,
+                description: this.text('env.dsh.skill', {
+                    name: skill.name,
+                    description: skill.description,
+                    path: `${this.mount}/skills/${skill.name}/SKILL.md`,
+                }),
+                path: `${this.mount}/skills/${skill.name}/SKILL.md`,
+                revision: 1,
+                time: 0,
+                builtin: true,
+            });
+        }
+        for (const server of this.mounted.servers) {
+            items.push({
+                ref: `dsh:mcp:${server.name}`,
+                kind: 'mcp',
+                name: server.name,
+                description: server.tools.length === 0
+                    ? this.text('env.dsh.server.notools', { name: server.name })
+                    : this.text('env.dsh.server', { name: server.name, tools: server.tools.join('、') }),
+                // No functions: the tools stay DSH tools, and an arbor MCP module here
+                // would be a second way to call the same thing.
+                functions: [],
+                revision: 1,
+                time: 0,
+                builtin: true,
+            });
+        }
+        return items;
+    }
+    /** The revisions, arbor's own: a mounted item has none of its own to give. */
+    async history(item) {
+        return this.inner.history(item);
+    }
+    /**
+     * The settings: the model's own from `/env/settings.json` once it installs
+     * one, and the deployment's seed until then.
+     */
+    async settings() {
+        return (await this.inner.settings()) ?? this.seed;
+    }
+    /**
+     * Validate drafts, refusing the whole call when one names an item DSH owns.
+     *
+     * Everything else is the inner environment's own validation, so a skill
+     * parses and an MCP server starts and lists its functions exactly as it does
+     * in any other deployment.
+     */
+    async validate(drafts) {
+        const taken = this.takenBy(drafts);
+        if (taken.length === 0)
+            return this.inner.validate(drafts);
+        return {
+            ok: false,
+            items: drafts.map(draft => ({
+                name: draft.name,
+                ok: false,
+                error: this.readonly(draft.kind, draft.name),
+            })),
+        };
+    }
+    /** Install drafts, refusing one that names an item DSH owns. */
+    async install(drafts, remove) {
+        this.refuseTaken([...this.takenBy(drafts), ...this.namedBy(remove)]);
+        return this.inner.install(drafts, remove);
+    }
+    /** Remove items, refusing one that names an item DSH owns. */
+    async remove(items) {
+        this.refuseTaken(this.namedBy(items));
+        return this.inner.remove(items);
+    }
+    /** What changed since a revision. DSH's mounted items never change one. */
+    async delta(since) {
+        return this.inner.delta(since);
+    }
+    /** The revision the environment stands at, arbor's own. */
+    async revision() {
+        return this.inner.revision();
+    }
+    /** Start every installed service again, after a host restart. */
+    async resume() {
+        await this.refresh().catch(() => { });
+        return this.inner.resume();
+    }
+    /**
+     * Call one function of an installed MCP server.
+     *
+     * A mounted DSH server has no functions here — its tools are DSH tools and
+     * run through the tool bridge — so a call naming one is refused rather than
+     * silently sent somewhere else.
+     */
+    async call(server, fn, args) {
+        if (this.mounted.servers.some(one => one.name === server)) {
+            throw arborError({
+                code: 'invalid',
+                rule: 'env.dsh.server.not_a_module',
+                message: this.text('refused.env.dsh.readonly', { kind: 'MCP 服务器', name: server }),
+                nextAction: this.text('next.env.dsh.readonly'),
+            });
+        }
+        return this.inner.call(server, fn, args);
+    }
+    /** One refusal naming an item DSH owns, in this package's own words. */
+    readonly(kind, name) {
+        return arborError({
+            code: 'invalid',
+            rule: 'env.dsh.readonly',
+            message: this.text('refused.env.dsh.readonly', { kind: kindLabel(kind), name }),
+            nextAction: this.text('next.env.dsh.readonly'),
+        });
+    }
+    /** One fixed string, from this package's own table. */
+    text(key, args = {}) {
+        return textOf(dshEnvText, key, args, key);
+    }
+    /** The drafts whose names DSH owns, as `kind:name` entries. */
+    takenBy(drafts) {
+        return drafts.map(draft => `${draft.kind}:${draft.name}`).filter(name => this.owned.has(name));
+    }
+    /** The item names a removal list names, as `kind:name` entries. */
+    namedBy(items) {
+        if (items === undefined)
+            return [];
+        const names = [];
+        for (const item of items) {
+            const text = String(item);
+            for (const candidate of [text, ...kinds().map(kind => `${kind}:${text}`)]) {
+                if (this.owned.has(candidate))
+                    names.push(candidate);
+            }
+        }
+        return names;
+    }
+    /** Refuse a call that would change an item DSH owns. */
+    refuseTaken(taken) {
+        const first = taken[0];
+        if (first === undefined)
+            return;
+        const [kind, name] = first.split(':');
+        throw this.readonly(kind, name ?? '');
+    }
+}
+/** Every item kind, for reading a bare name a removal list may carry. */
+function kinds() {
+    return ['skill', 'mcp', 'service', 'settings'];
+}
+/** One kind, as the refusal names it. */
+function kindLabel(kind) {
+    return kind === 'mcp' ? 'MCP 服务器' : kind === 'skill' ? '技能' : kind === 'service' ? '服务' : '设置';
+}
+export { dshEnvText } from "./text.js";
+export { readDshSkills, syncSkills, skillDirectory, skillFile, dshSkillSource, } from "./skills.js";
+export { serversOfToolNames, serverOfToolName } from "./servers.js";

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@4fu/dsh-arbor-env",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2026.1110.1",
+  "type": "module",
+  "description": "/env for arbor inside DSH: DSH's skills and MCP servers mounted read-only into arbor's environment, beside the settings, built-in skills and the model's own installs under DSH_HOME/arbor",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.d.ts",
+    "index.js",
+    "servers.d.ts",
+    "servers.js",
+    "skills.d.ts",
+    "skills.js",
+    "text.d.ts",
+    "text.js"
+  ],
+  "dependencies": {
+    "@4fu/arbor-environment-dir": "2026.1109.1",
+    "@4fu/arbor-errors": "2026.1107.0",
+    "@4fu/arbor-interfaces": "2026.1109.1",
+    "@4fu/arbor-prompt": "2026.1109.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-skill": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.1"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/4fuu/dsh-arbor.git",
+    "directory": "packages/arbor-env"
+  },
+  "engines": {
+    "node": ">=24.9.0",
+    "dsh": "0.2.2-rc.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "types": "./index.d.ts",
+  "main": "./index.js"
+}

package/servers.d.ts

@@ -0,0 +1,37 @@
+/**
+ * DSH's MCP servers, as arbor's environment sees them.
+ *
+ * DSH has no MCP registry service to ask: an MCP server is a `mcp-client`
+ * plugin row, and what it publishes is its tools on `ctx.tools` under the
+ * server-qualified public name `mcp__<serverName>__<rawName>`
+ * (`@deepseek-ai/dsh-mcp-client`, `lib/index.js`, `publicToolName`; the config's
+ * `serverName` must match `[A-Za-z0-9_-]{1,32}`, so the segment between the
+ * first `mcp__` and the next `__` is always the server's own name). It also
+ * contributes one system-prompt section named `mcp:<serverName>`
+ * (`registerServerContext`), which is third-party content the prompt bridge
+ * carries into `<dsh>`.
+ *
+ * So the server list is read off the tool names, which is the same thing the
+ * tool bridge bridges: a DSH MCP tool arrives in arbor as an external tool with
+ * that name, and it is never restated as an arbor MCP module. The item listed
+ * here therefore declares no functions — an arbor MCP module would give the
+ * model a second way to call the same tool, which is exactly what must not
+ * happen.
+ */
+/** One DSH MCP server, as this package lists it. */
+export interface DshServer {
+    readonly name: string;
+    /** The public names of the tools this server published, as DSH names them. */
+    readonly tools: readonly string[];
+}
+/**
+ * The server name one public tool name carries, or `undefined` when the name is
+ * not an MCP tool's.
+ *
+ * The server's own name is `[A-Za-z0-9_-]{1,32}` by config, so the first `__`
+ * after the prefix ends it — including in the lossy-normalized case, where a
+ * hash is appended after the raw name rather than inside the server's segment.
+ */
+export declare function serverOfToolName(name: string): string | undefined;
+/** Every MCP server the named DSH tools belong to, by server name. */
+export declare function serversOfToolNames(names: readonly string[]): readonly DshServer[];

package/servers.js

@@ -0,0 +1,52 @@
+/**
+ * DSH's MCP servers, as arbor's environment sees them.
+ *
+ * DSH has no MCP registry service to ask: an MCP server is a `mcp-client`
+ * plugin row, and what it publishes is its tools on `ctx.tools` under the
+ * server-qualified public name `mcp__<serverName>__<rawName>`
+ * (`@deepseek-ai/dsh-mcp-client`, `lib/index.js`, `publicToolName`; the config's
+ * `serverName` must match `[A-Za-z0-9_-]{1,32}`, so the segment between the
+ * first `mcp__` and the next `__` is always the server's own name). It also
+ * contributes one system-prompt section named `mcp:<serverName>`
+ * (`registerServerContext`), which is third-party content the prompt bridge
+ * carries into `<dsh>`.
+ *
+ * So the server list is read off the tool names, which is the same thing the
+ * tool bridge bridges: a DSH MCP tool arrives in arbor as an external tool with
+ * that name, and it is never restated as an arbor MCP module. The item listed
+ * here therefore declares no functions — an arbor MCP module would give the
+ * model a second way to call the same tool, which is exactly what must not
+ * happen.
+ */
+/** The public-name prefix every DSH MCP tool carries. */
+const MCP_PREFIX = 'mcp__';
+/**
+ * The server name one public tool name carries, or `undefined` when the name is
+ * not an MCP tool's.
+ *
+ * The server's own name is `[A-Za-z0-9_-]{1,32}` by config, so the first `__`
+ * after the prefix ends it — including in the lossy-normalized case, where a
+ * hash is appended after the raw name rather than inside the server's segment.
+ */
+export function serverOfToolName(name) {
+    if (!name.startsWith(MCP_PREFIX))
+        return undefined;
+    const rest = name.slice(MCP_PREFIX.length);
+    const cut = rest.indexOf('__');
+    if (cut <= 0)
+        return undefined;
+    return rest.slice(0, cut);
+}
+/** Every MCP server the named DSH tools belong to, by server name. */
+export function serversOfToolNames(names) {
+    const byServer = new Map();
+    for (const name of names) {
+        const server = serverOfToolName(name);
+        if (server === undefined)
+            continue;
+        byServer.set(server, [...(byServer.get(server) ?? []), name]);
+    }
+    return [...byServer]
+        .map(([name, tools]) => ({ name, tools: tools.sort() }))
+        .sort((left, right) => left.name.localeCompare(right.name));
+}

package/skills.d.ts

@@ -0,0 +1,69 @@
+/**
+ * DSH's skills, as arbor's environment sees them.
+ *
+ * DSH owns its skill catalog: `ctx.skills` is the layered `SkillRegistry`
+ * (`@deepseek-ai/dsh-skill`, `lib/types/index.d.ts`), whose `list` answers with
+ * the winning summaries for a working directory and whose `get` loads one
+ * skill's body. The shipped `headless` profile mounts the registry plus the
+ * filesystem provider (`packages/bundle/base/cordis.patch.yml`, rows `skill`
+ * and `skill-filesystem`) and the `skill` tool (`tool-skill`).
+ *
+ * Arbor's environment is a directory of `SKILL.md` files a window reads at
+ * `/env` (`@4fu/arbor-environment-dir`), so a DSH skill is mounted by writing
+ * its body to `<env>/skills/<name>/SKILL.md` and listing it with that path. The
+ * body is DSH's own — the markdown after its frontmatter — and the description
+ * on the listing is DSH's own, carried verbatim rather than restated.
+ *
+ * What is staged is the instruction file and nothing else: a skill's other
+ * files stay where DSH keeps them, and a window reaches them by their absolute
+ * path, which every sandbox mode permits reading.
+ */
+import type { SkillDefinition, SkillSummary } from '@deepseek-ai/dsh-skill';
+/** One DSH skill, as this package mounts it. */
+export interface DshSkill {
+    readonly name: string;
+    readonly description: string;
+    /** The skill's markdown body, after its frontmatter. */
+    readonly body: string;
+}
+/** What the DSH side of the mount answers with. */
+export interface DshSkillSource {
+    /** Every model-invocable skill DSH offers for one working directory. */
+    list(cwd: string): Promise<readonly SkillSummary[]>;
+    /** One skill's body, or `undefined` when it is no longer loadable. */
+    get(name: string, cwd: string): Promise<SkillDefinition | undefined>;
+    /** Hear that DSH's skill catalog may have changed; returns the disposer. */
+    onChange(listener: () => void): () => void;
+}
+/** The skill source over DSH's own registry. */
+export declare function dshSkillSource(skills: {
+    list(options?: {
+        cwd?: string;
+    }): Promise<readonly SkillSummary[]>;
+    get(name: string, options?: {
+        cwd?: string;
+    }): Promise<SkillDefinition | undefined>;
+}, onChange: (listener: () => void) => () => void): DshSkillSource;
+/**
+ * The directory the mounted skills live in, under the environment's own.
+ *
+ * `<env>/skills/<name>/SKILL.md` is the layout arbor's environment already uses
+ * (`@4fu/arbor-environment-dir`, `directory-environment.d.ts`), so a mounted
+ * skill sits beside the model's own and arbor's built-in ones and reads the same
+ * way.
+ */
+export declare function skillDirectory(environmentDirectory: string, name: string): string;
+/** One mounted skill's `SKILL.md`: DSH's frontmatter, then DSH's body. */
+export declare function skillFile(skill: DshSkill): string;
+/**
+ * Write the current DSH skills into the environment's own directory, and remove
+ * the mounted ones that are gone.
+ *
+ * The environment's directory is the host's own data under `DSH_HOME/arbor`,
+ * the same place the journal and the note store live, so it is written with
+ * `node:fs` like they are: it is not the session's workspace and the sandbox
+ * that fences a window's files does not govern it.
+ */
+export declare function syncSkills(environmentDirectory: string, skills: readonly DshSkill[]): Promise<void>;
+/** Read the current DSH skills for one working directory. */
+export declare function readDshSkills(source: DshSkillSource, cwd: string): Promise<readonly DshSkill[]>;

package/skills.js

@@ -0,0 +1,88 @@
+/**
+ * DSH's skills, as arbor's environment sees them.
+ *
+ * DSH owns its skill catalog: `ctx.skills` is the layered `SkillRegistry`
+ * (`@deepseek-ai/dsh-skill`, `lib/types/index.d.ts`), whose `list` answers with
+ * the winning summaries for a working directory and whose `get` loads one
+ * skill's body. The shipped `headless` profile mounts the registry plus the
+ * filesystem provider (`packages/bundle/base/cordis.patch.yml`, rows `skill`
+ * and `skill-filesystem`) and the `skill` tool (`tool-skill`).
+ *
+ * Arbor's environment is a directory of `SKILL.md` files a window reads at
+ * `/env` (`@4fu/arbor-environment-dir`), so a DSH skill is mounted by writing
+ * its body to `<env>/skills/<name>/SKILL.md` and listing it with that path. The
+ * body is DSH's own — the markdown after its frontmatter — and the description
+ * on the listing is DSH's own, carried verbatim rather than restated.
+ *
+ * What is staged is the instruction file and nothing else: a skill's other
+ * files stay where DSH keeps them, and a window reaches them by their absolute
+ * path, which every sandbox mode permits reading.
+ */
+import { mkdir, writeFile, rm } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+/** The skill source over DSH's own registry. */
+export function dshSkillSource(skills, onChange) {
+    return {
+        list: cwd => skills.list({ cwd }),
+        get: (name, cwd) => skills.get(name, { cwd }),
+        onChange,
+    };
+}
+/**
+ * The directory the mounted skills live in, under the environment's own.
+ *
+ * `<env>/skills/<name>/SKILL.md` is the layout arbor's environment already uses
+ * (`@4fu/arbor-environment-dir`, `directory-environment.d.ts`), so a mounted
+ * skill sits beside the model's own and arbor's built-in ones and reads the same
+ * way.
+ */
+export function skillDirectory(environmentDirectory, name) {
+    return join(environmentDirectory, 'skills', name, 'SKILL.md');
+}
+/** One mounted skill's `SKILL.md`: DSH's frontmatter, then DSH's body. */
+export function skillFile(skill) {
+    return `---\nname: ${skill.name}\ndescription: ${skill.description.replaceAll('\n', ' ')}\n---\n\n${skill.body}\n`;
+}
+/**
+ * Write the current DSH skills into the environment's own directory, and remove
+ * the mounted ones that are gone.
+ *
+ * The environment's directory is the host's own data under `DSH_HOME/arbor`,
+ * the same place the journal and the note store live, so it is written with
+ * `node:fs` like they are: it is not the session's workspace and the sandbox
+ * that fences a window's files does not govern it.
+ */
+export async function syncSkills(environmentDirectory, skills) {
+    const wanted = new Set(skills.map(skill => skill.name));
+    const root = join(environmentDirectory, 'skills');
+    await mkdir(root, { recursive: true });
+    for (const skill of skills) {
+        const path = skillDirectory(environmentDirectory, skill.name);
+        await mkdir(dirname(path), { recursive: true });
+        await writeFile(path, skillFile(skill), 'utf8');
+    }
+    // A mounted skill DSH no longer offers is removed, so `/env` says what is
+    // true now rather than what was true when the process started.
+    const { readdir } = await import('node:fs/promises');
+    for (const entry of await readdir(root, { withFileTypes: true }).catch(() => [])) {
+        if (!entry.isDirectory() || wanted.has(entry.name))
+            continue;
+        await rm(join(root, entry.name), { recursive: true, force: true });
+    }
+}
+/** Read the current DSH skills for one working directory. */
+export async function readDshSkills(source, cwd) {
+    const summaries = await source.list(cwd);
+    const skills = [];
+    for (const summary of summaries) {
+        if (summary.invocation?.modelInvocable === false)
+            continue;
+        const definition = await source.get(summary.name, cwd);
+        skills.push({
+            name: summary.name,
+            description: summary.description,
+            body: definition?.content ?? '',
+        });
+    }
+    return skills;
+}

package/text.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The model-facing text this environment contributes.
+ *
+ * Every fixed string this package writes lives here, in Chinese, one entry per
+ * string. The host merges this table over its own, so the wording of a mounted
+ * DSH skill's line and of a refusal is the deployment's.
+ *
+ * A mounted item's own description is DSH's, carried verbatim: a skill's
+ * frontmatter description and an MCP server's are third-party content, and
+ * restating them would put this package's words where DSH's belong.
+ */
+import type { TextTable } from '@4fu/arbor-interfaces';
+/** This package's own fixed strings. */
+export declare const dshEnvText: TextTable;

package/text.js

@@ -0,0 +1,24 @@
+/**
+ * The model-facing text this environment contributes.
+ *
+ * Every fixed string this package writes lives here, in Chinese, one entry per
+ * string. The host merges this table over its own, so the wording of a mounted
+ * DSH skill's line and of a refusal is the deployment's.
+ *
+ * A mounted item's own description is DSH's, carried verbatim: a skill's
+ * frontmatter description and an MCP server's are third-party content, and
+ * restating them would put this package's words where DSH's belong.
+ */
+/** This package's own fixed strings. */
+export const dshEnvText = {
+    // ---- what a mounted item is -------------------------------------------
+    'env.dsh.skill': 'DSH 的技能 {name}（只读）：{description}（{path}）。'
+        + '技能自带的其它文件仍在 DSH 那边，按绝对路径用 read 或 bash 读。',
+    'env.dsh.server': 'DSH 的 MCP 服务器 {name}（只读）：它的工具作为 DSH 工具直接调用'
+        + '（{tools}），不是本环境的模块函数，也不要为它再装一个 MCP 服务器。',
+    'env.dsh.server.notools': 'DSH 的 MCP 服务器 {name}（只读）：它当前没有发布任何工具。',
+    // ---- refusals ---------------------------------------------------------
+    'refused.env.dsh.readonly': '{kind} {name} 是 DSH 挂进来的，只读：不能用 reload 增删改它。',
+    'next.env.dsh.readonly': '要改 DSH 这边的技能或 MCP 服务器，请在 DSH 里改；'
+        + '本环境只接受模型自己安装的技能、MCP 服务器和服务。',
+};